Analysis of Popa Botnet Malware Campaign via NetNut Proxy Platform

Vulnerability Overview Vulnerability Name: NetNut Proxy Platform, Popa Botnet Description: The U.S. Federal Bureau of Investigation (FBI), in collaboration with industry partners, seized hundreds of domains associated with NetNut. NetNut is a residential proxy service platform operated by the Israeli company Alarum Technologies. The platform was used to distribute malware, resulting in the compromise of at least 2 million devices. Impact Scope Affected Devices: At least 2 million devices, including smart TVs and streaming boxes. Affected Regions: Global impact, with the primary effect on the United States. Affected Users: Users of NetNut’s residential proxy services, as well as attackers conducting malicious activities through the NetNut network. Remediation Measures FBI Action: The FBI has seized NetNut’s domains and notified relevant service providers. Alarum Technologies: Alarum Technologies stated it will fully cooperate with the investigation, ensure its infrastructure is thoroughly examined, and hold responsible parties accountable. User Recommendations: - Check devices for suspicious applications or SDKs. - Update device firmware and applications, ensuring the use of official Android TV OS and Play Protect certification. - Avoid installing applications from untrusted sources. POC Code or Exploit Code No POC Code: No specific Proof of Concept (POC) or exploit code is provided in the source material. Additional Information Related Organizations: FBI, IRS Criminal Investigation Division (IRS-CI), Google Threat Intelligence Group (GTIG), Shadowserver Foundation, among others. Timeline: - July 2, 2026: FBI announces the seizure of NetNut domains. - June 19, 2026: Three security firms publish similar findings. - June 2026: NetNut’s homepage replaced with an FBI seizure notice. Summary The vulnerability involving the NetNut Proxy Platform and Popa Botnet entails malware infections on a massive scale, primarily affecting smart TVs and streaming boxes. The FBI and related agencies have taken action to seize domains and are urging users to inspect their devices and implement security measures.

Goal Reached Thanks to every supporter — we hit 100%!

Analysis of Popa Botnet Malware Campaign via NetNut Proxy Platform